The conventional riser disconnect systems are based on either an operator initiated emergency disconnect system requiring the active intervention of an operator (by the push of a button) and automatic disconnect systems based on a weak link placed in the riser system which is designed to fail mechanically in an emergency scenario before any other critical components fail. Such disconnect systems are typically referred to as “weak links”.
The key purpose of a weak link is to protect the well barrier(s) or other critical structure(s) interfacing the riser in accidental scenarios, such as heave compensator lock-up or loss of rig position which may be caused by loss of an anchor (dragged anchor), drift-off, where the rig or ship drifts off location because the rig or ship loses power, or drive-off, which is a scenario where the dynamic positioning system on the rig or ship fails for any reason causing the ship to drive off location in any arbitrary direction. In such accidental scenarios operators will have very limited time to recognize that an accident is happening and to trigger a release of the riser from the well or other critical structure(s) attached to the riser. In such accidental scenarios where the operators do not have reasonable time to react to an accident the weak link shall ensure that the integrity of the well barrier(s) or other critical interfacing structure(s) is/are protected.
When a riser is connected to a wellhead, a X-mas tree (or a lower riser package with a X-mas tree) is landed and locked onto the wellhead. The riser system is then fixed to the well on the seabed in the lower end. The upper end of the riser is typically suspended from a so-called heave compensator 1 and/or riser tensioning system in the upper end as illustrated in FIG. 1. The riser tensioning system applies top tension to the riser 2 and is connected to a heave compensator 1 which compensates for the relative heave motion between the vessel 3 (e.g. a rig or a ship) moving in the waves and the riser fixed to the seabed 4. The heave compensator system 1 is typically based on a combination of hydraulic pistons and pressurized air accumulators (not shown). The hydraulic pistons are driven actively up and down by a hydraulic power unit in order to compensate for the vertical motion of the vessel 3 in the waves. The air accumulators are connected to the same system and are used to maintain a relatively constant tension in the system. This is done by suspending the risers from cylinders resting on a pressurized air column, where the pressure is set according to the load in the system. The volume of the air accumulators and the stroke of the cylinders will then define the motion hysteresis and therefore the tension in the system as the vessel 3 moves vertically in the waves.
A compensator lock-up refers to a scenario where the heave compensation system fails, causing the heave compensator cylinders to lock and thereby failing to compensate for the heave motion between riser 2 and vessel 3, ref. FIG. 2. This may result in snag loads and excessive tension forces on the riser 2. Such snag loads may cause damage to well barrier(s) 5 or other interfacing structure(s). A weak link in the riser 2 will, when properly designed, protect the well barrier(s) 5 from damage in case of a compensator lock-up occurring. However, one challenge is that during normal operation the vessel 3 may be positioned within a certain operational window above the well on the seabed 4. This gives a relative angle α between the vessel 3 and the well on the seabed 4. This angle α means that any tension load in the riser 2 will also cause bending moments in the well barrier(s) 5. To properly protect the well barrier(s) 5 in case of heave compensator lock-up, a weak link will need to release before the combined load from riser tension and bending moment due to vessel 3 offset damages the well barrier(s) 5.
Loss of position occurs when the vessel 3 fails to maintain its position within defined boundaries above the wellhead. Anchored vessels 3 usually experience loss of position caused by loss of one or more anchors. For dynamically positioned (DP) vessels, loss of position is normally caused by DP failure or by operator error causing the vessel 3 to drive-off from its intended position. In a drift-off scenario the vessel either does not have sufficient power to stay in its position given the current weather conditions, or vessel power is lost and the vessel will drift off in the direction of the wind, waves and currents. All such accidental scenarios result in excessive vessel 3 offset relative to well barrier(s) 5, ref. FIG. 3. When the position of the vessel moves outside the allowable boundaries, the resulting riser angle α in combination with riser tension will induce high bending moments in the lower and upper part of the riser 2. Furthermore as the relative distance between the vessel 3 and the well barrier(s) 5 on the seabed increases, the heave compensator cylinder will stroke out to compensate an otherwise increase in tension. Subsequently the heave compensator 1 will stroke out, leading to a rapid increase in the riser tension. When this occurs the relative angle α between the well barrier(s) 5 on the seabed 4 and the vessel 3 will have increased significantly and the rapid tension increase will cause high bending moments in the well barrier(s) 5, ref. FIG. 3.
To protect the well barrier(s) 5 in the mentioned accidental scenarios, a weak link needs to disconnect the riser 2 from the well barrier(s) 5 prior to exceeding the combined load capacity of the well barrier(s) 5 in tension and bending, see FIG. 6.
Exceeding the load capacity of the well barrier(s) 5 may involve damage of the well head, damage inside the well, damage on the riser 2 etc., all of which are considered to be serious accidental scenarios with high risk towards personnel and the environment.
Damage of the well barrier(s) 5 may result in costly and time consuming repair work, costly delays due to lack of progress in the operation, and last, but not least, environmental and human risks in the form of pollution, blow-outs, explosions, fires, etc. The ultimate consequence of well barrier damage is a full scale subsea blow-out, with oil and gas from the reservoir being released directly and uncontrollably into the ocean. If the down-hole safety valve should fail or be damaged in the accident, there are no more means of shutting down the well without drilling a new side well for getting into and plugging the damaged well.
The challenges with existing weak link designs are related to the combination of fulfilling all design requirements (safety factors, etc.) during normal operation of the system, and at the same time ensuring reliable disconnect of the system in an accidental scenario.
The most common weak link concepts today rely on structural failure in a component or components. Typical designs involve a flange with bolts that are designed to break at a certain load, or a pipe section that is machined down over a short length to cause a controlled break of the riser in that location.
Most conventional weak links that are in use today only rely on tension forces, i.e. a given weak link is designed to break at a certain, pre-defined tension load. However, the emergency situations that arise do not involve tension forces alone. In the case of e.g. a drift-off, there will be significant bending moments introduced into the well barrier(s) 5 in addition to the tension forces. Even in a heave compensator lock-up scenario, bending moments acting on the well barrier(s) 5 may be significant due to the rig/vessel offset within the allowable operation window. It is not uncommon that the weather window for an operation is limited because the weak link can only accommodate a certain vessel offset in normal operation as illustrated by a typical operational diagram shown in FIG. 4. Vessel station keeping ability above the well will be reduced with increasing winds and waves and normal variations in the position of the rig above the well will increase. If the offset exceeded a certain limit the weak link will not protect the well barrier(s) 5 in case of a heave compensator lock-up. Therefore, the ability of the weak link to fail due to bending may affect the weather window of the operation.
Furthermore, the internal pressure in a riser, which may vary from atmospheric up to 10,000 psi or higher, has a significant impact on the loads experienced by the riser 2, the well barrier(s) 5 and on the weak link.
When the internal pressure is greater than the external pressure the riser component will experience increased axial tension and hoop tension. The axial tension caused by internal overpressure is often referred to as the end cap load [N] (=internal area·internal overpressure). Internal pressure causing the pipe to fail in hoop tension is referred to as the burst pressure.
The effect of internal pressure causes a dilemma in weak link designs based on structural failure:                1. The weak link needs to be dimensioned for operation under full pressure with normal safety margins.        2. The tension and bending capacity of the well barrier(s) are reduced by internal pressure.        3. In some operations the well barrier(s) will be pressurized, but the riser with the weak link will be unpressurised.        4. In an accidental scenario the weak link must release before the well barrier(s) is(are) damaged, even when the well barrier(s) is(are) pressurized and the weak link is not pressurized.        
Point 4 above is often challenging to achieve in the design of a weak link based on structural failure because the band between minimum capacity in normal operation and maximum break load in an accidental scenario becomes too wide. In some cases with high pressure system it may not be practically achievable to design a weak link based on structural failure.
FIG. 5 illustrates the challenges linked to designing a weak link which is based on structural failure, e.g. the conventional breaking of weakened flange bolts or the like. The illustration shows a system where the nominal system tension in the weak link is 100 T (1 T=1 ton=1000 kg). The system shall work under pressure and the end cap effect of the pressure increases the tension to more than 200 T which the weak link needs to be designed for. In the design of the weak link, safety factors and spread in material properties has to be allowed for thus increasing the actual capacity of the part to more than 400 T. The weak link will normally also have to accommodate a certain bending moment in normal operation, which in the illustration mentioned above, has increased the structural capacity of the weak link to around 500 T. This means that in the example above, a weak link designed for a maximum operational tension of 100 T and a given bending moment, cannot be designed with a breaking load less than 500 T. In some cases the gap between design load and the minimum possible breaking load is greater than the allowable capacity in the well barrier(s), thus requiring a reduction in the operational capacities, which again reduces the operational envelopes. As the examples shows, the fact that the weak link shall be designed for full pressure, but at the same time shall work as a weak link when there is no pressure in the system, will for a high pressure system contribute significantly to the gap between the operational design load and the minimum breaking load in a weak link based on structural failure.
In additional, to the technical challenges related to existing weak link solutions based on structural failure, there are also schedule and cost challenges related to the conventional systems. A weak link based on structural failure requires a comprehensive qualification program for each project and typically imposes stringent requirements on material deliveries to control material properties of the parts designed to fail. These qualification programs and the additional requirements for particular material properties are often a challenge with respect to project schedules.
FIG. 6 shows a typical capacity curve for combined loading for well barrier(s) 5 being defined by a straight line along which all safety factors in the well barrier design have been fully utilized. This line does not represent the structural failure of the well barrier(s), but indicates the calculated allowable capacity of the well barrier(s) 5. If the combined loads exceed this line there is no guarantee for the integrity of the well barrier(s), and it is likely that the barrier(s) is(are) damaged and possible leaks may occur.
FIG. 7 illustrates how the loads in the riser 2 and in the well barrier(s) 5 develop in a heave compensator lock-up, and how this relates to the capacity of the riser weak link and the capacity of the well barrier(s). The actual capacity of a weak link defined by structural failure is shown as the curved capacity curve for the riser pipe.
When the heave compensator lock-up occurs, the riser 2 will see a rapid increase in axial loading, as shown in the upper load diagram. At the same time the well barrier(s) 5 will see an increase in axial load but also in bending moment due to the rigs offset relative to the position of the well as shown in the lower load diagram by the angle α. The challenge with current weak link design is then that with a certain rig offset the load capacity of the well barrier(s) 5 will be exceeded before the load in the riser 2 reaches the structural capacity of the weak link.
FIG. 8 shows the same type of illustration for a loss of position scenario. When the rig 3 loses its position the load in the riser 2 will initially remain constant, because the heave compensator will stroke out to maintain a constant load in the riser. Once the heave compensator 1 strokes out, the tension in the riser 2 will increase rapidly as shown in the upper load diagram. The load in the well barrier(s) 5 will also remain close to constant while the heave compensator 1 strokes out (there will be some increase in the bending loads in the barrier(s)) and when the heave compensator 1 stops the axial load in the riser 2 will increase rapidly causing very high bending loads in the well barrier(s) 5. In such accidental scenarios existing weak links relying on structural failure in a riser component will typically reach its structural capacity curve long after having exceeded the design load capacity curve of the well barrier(s).